How to disable an account from remote accessing

hanxuerui · 06-27-2003, 12:27 PM

I have a few accounts used as service account, I am wondering is there a way to let the user id work but can not accessed from out side, for example, if user try to ssh by using this id, the server will refuse the request.

Thanks.

Any hint is appreciated.

MArgRes · 06-27-2003, 01:02 PM

If you mean that nobody should connect to the accounts, you can put an '/sbin/nologin' at the end of their /etc/passwd entry...

hanxuerui · 06-27-2003, 02:25 PM

Thanks, MArgRes, but what if I need su to this account? will it allow you su to it?

MArgRes · 06-27-2003, 04:25 PM

Nope. That will disallow any login attempts for that account. I'm not sure if there is a way to only disallow logins on certain accounts from the outside...

beltorak · 06-27-2003, 05:30 PM

edit '/etc/login.access'; add the following line:

Code:

-:deny_this_account and_this_one etc etc_etc:ALL EXCEPT LOCAL

The term 'account' applies to users and groups. The primary group of a user is not consulted, however, so you might want to create a group (no_remote), and add all users that you want to deny remote logins to that group, the use: '-:no_remote:ALL EXCEPT LOCAL'.

-t.

hanxuerui · 06-27-2003, 05:32 PM

That is still appreciated. Let's wait and see, I will dig into some document when I get a chance.

unSpawn · 06-30-2003, 07:15 AM

I have a few accounts used as service account, I am wondering is there a way to let the user id work but can not accessed from out side, for example, if user try to ssh by using this id, the server will refuse the request.
You should use the DenyGroups and DenyUsers directives.
"man sshd_config" for more info.

hanxuerui · 06-30-2003, 09:05 AM

Thanks everybody. Let me give it a try.

hanxuerui · 06-30-2003, 09:19 AM

Quote:

Originally posted by beltorak
edit '/etc/login.access'; add the following line:

Code:

-:deny_this_account and_this_one etc etc_etc:ALL EXCEPT LOCAL

The term 'account' applies to users and groups. The primary group of a user is not consulted, however, so you might want to create a group (no_remote), and add all users that you want to deny remote logins to that group, the use: '-:no_remote:ALL EXCEPT LOCAL'.

-t.

This does not work for ssh, I am guessing it must be something about telnet?

I would like to hear more about this file.

beltorak · 07-02-2003, 08:35 PM

Ahh; so you are right... silly me. Try the file '/etc/ssh/sshd_config'. Read the man page for it, and look at the entries for "AllowGroups', 'AllowUsers', 'DenyGroups', and 'DenyUsers'.

-t.

mastahnke · 07-17-2003, 08:54 AM

Put a * in the password field for that user. Then you can su - to that user, because with a * in pw field, you can't log in.

hanxuerui · 07-17-2003, 10:09 AM

Thank you. So many tricks. Hope there are some book out somewhere.